xumm-xaman[.]app

Analysis indicates that the domain xumm-xaman.app was used to host a wallet‑seed phishing page that mimics the Xumm extension, as reflected in the page title “Xaman Wallet | Secure XRP and Xahau Self‑Custody | Xumm Extension”. The domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare’s network (ASN 13335) and is geolocated to the United States. Registration details show the domain was provisioned through Cloudflare, Inc., and the authoritative nameservers are linda.ns.cloudflare.com and will.ns.cloudflare.com. No TLS certificate was observed, meaning the site served over plain HTTP, which is consistent with the lack of HTTPS protection.

VirusTotal scans reported five detections out of ninety‑five antivirus engines, confirming that multiple security products flagged the host as malicious. The domain appears on a single public blocklist and is actively listed by PhishDestroy, indicating that at least one anti‑phishing service has taken it down. AlienVault OTX references the domain in one pulse, providing additional community‑based corroboration. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification.

The site’s current status is offline, which limits real‑time verification but does not remove the historical evidence of abuse. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor for any resurgence of the same IP address or Cloudflare‑hosted subdomains that could be leveraged for similar impersonation campaigns. Because the infrastructure relies on Cloudflare’s shared hosting, future malicious sites may reuse the same IP block, so broader IP‑based blocking may be warranted. Continuous observation of the IP 188.114.97.3 and associated Cloudflare nameservers is recommended to detect re‑activation.